3846cf9d00ba165a7e28ef32f09b30b4

Sharing

Copy URL Twitter E-mail

General

Target

3846cf9d00ba165a7e28ef32f09b30b4
Size

23KB
MD5

3846cf9d00ba165a7e28ef32f09b30b4
SHA1

05ba6bc6a5f8b29b5e91ee38aef21541f7a8eb52
SHA256

d5af780533ca0992d1fddb8d572f6bcdcadbd6bcf4c5fd8d44f3066dd31d9c9d
SHA512

898ca760ae195369e450a84a74bd5587e28a6e7336ccd14a9512859e815bd502573ba8c49ee4716caa11d8d8ca37c87bd838bae963084d78f9a7fae106b77136
SSDEEP

384:tZF6ffagOdswPPWqCD2YBU3JiBYekuqIfKOxUgpeaLbe1HVo:tkOdrPdCDHxBYekuqIfz0aL+o

Score

1^/10

Malware Config

Signatures

Files

3846cf9d00ba165a7e28ef32f09b30b4
.exe windows:4 windows x86 arch:x86

2156323607643d982041dba70bb783e1

Code Sign

12:00:12:56:88:4a:29:9a:c4:21:44:5a:79:00:00:00:12:56:88
Certificate

Issuer

CN=Microsoft RSA TLS CA 01,O=Microsoft Corporation,C=US

Not Before

29/06/2021, 21:35

Not After

29/06/2022, 21:35

Subject

CN=*.oneroute.microsoft.com

78:f7:6a:bc:71:c6:bf:72:08:11:32:1d:73:49:85:76:9a:08:28:aa
Signer

Actual PE Digest

78:f7:6a:bc:71:c6:bf:72:08:11:32:1d:73:49:85:76:9a:08:28:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateFileA
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
SetErrorMode
SetUnhandledExceptionFilter
Sleep
SleepEx
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_initterm
_iob
_onexit
abort
atan
calloc
exit
fprintf
free
fwrite
malloc
memcpy
rand
signal
strcmp
strlen
strncmp
vfprintf

ws2_32

WSACleanup
closesocket
connect
gethostbyname
htons
recv
socket

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 196B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2156323607643d982041dba70bb783e1

Code Sign

12:00:12:56:88:4a:29:9a:c4:21:44:5a:79:00:00:00:12:56:88Certificate

78:f7:6a:bc:71:c6:bf:72:08:11:32:1d:73:49:85:76:9a:08:28:aaSigner

Headers

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Sections

.text Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 44B

.rdata Size: 2KB - Virtual size: 2KB

/4 Size: 512B - Virtual size: 232B

.bss Size: - Virtual size: 196B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

12:00:12:56:88:4a:29:9a:c4:21:44:5a:79:00:00:00:12:56:88
Certificate

78:f7:6a:bc:71:c6:bf:72:08:11:32:1d:73:49:85:76:9a:08:28:aa
Signer

.text
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 44B

.rdata
Size: 2KB - Virtual size: 2KB

/4
Size: 512B - Virtual size: 232B

.bss
Size: - Virtual size: 196B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B